feat: add field create_aws_s3_bucket_public_access_block to variable runner_worker_cache

main.tf

@@ -392,6 +392,8 @@ module "cache" {
   kms_key_id = local.kms_key
 
   name_iam_objects = local.name_iam_objects
+
+  create_aws_s3_bucket_public_access_block = var.runner_worker_cache.create_aws_s3_bucket_public_access_block
 }
 
 ################################################################################

modules/cache/main.tf

@@ -95,6 +95,8 @@ resource "aws_s3_bucket_server_side_encryption_configuration" "build_cache_encry
 
 # block public access to S3 cache bucket
 resource "aws_s3_bucket_public_access_block" "build_cache_policy" {
+  count = var.create_aws_s3_bucket_public_access_block ? 1 : 0
+
   bucket = aws_s3_bucket.build_cache.id
 
   block_public_acls       = true

modules/cache/moved.tf

@@ -0,0 +1,4 @@
+moved {
+  from = aws_s3_bucket_public_access_block.build_cache_policy
+  to   = aws_s3_bucket_public_access_block.build_cache_policy[0]
+}

modules/cache/variables.tf

@@ -91,3 +91,8 @@ variable "kms_key_id" {
   type        = string
   default     = ""
 }
+
+variable "create_aws_s3_bucket_public_access_block" {
+  type    = bool
+  default = true
+}

variables.tf

@@ -421,18 +421,19 @@ variable "runner_worker_cache" {
     versioning = Boolean used to enable versioning on the cache bucket. Requires `create = true`.
   EOT
   type = object({
-    access_log_bucket_id     = optional(string, null)
-    access_log_bucket_prefix = optional(string, null)
-    authentication_type      = optional(string, "iam")
-    bucket                   = optional(string, "")
-    bucket_prefix            = optional(string, "")
-    create                   = optional(bool, true)
-    expiration_days          = optional(number, 1)
-    include_account_id       = optional(bool, true)
-    policy                   = optional(string, "")
-    random_suffix            = optional(bool, false)
-    shared                   = optional(bool, false)
-    versioning               = optional(bool, false)
+    access_log_bucket_id                     = optional(string, null)
+    access_log_bucket_prefix                 = optional(string, null)
+    authentication_type                      = optional(string, "iam")
+    bucket                                   = optional(string, "")
+    bucket_prefix                            = optional(string, "")
+    create                                   = optional(bool, true)
+    expiration_days                          = optional(number, 1)
+    include_account_id                       = optional(bool, true)
+    policy                                   = optional(string, "")
+    random_suffix                            = optional(bool, false)
+    shared                                   = optional(bool, false)
+    versioning                               = optional(bool, false)
+    create_aws_s3_bucket_public_access_block = optional(bool, true)
   })
   default = {}
 }
@@ -765,3 +766,8 @@ variable "debug" {
   })
   default = {}
 }
+
+variable "create_aws_s3_bucket_public_access_block" {
+  type    = bool
+  default = true
+}